Domain 1 — Threats, Attacks, and Vulnerabilities

Week of 2026-09-15 · Download .docx

Objectives

Distinguish threat actor types by motivation, resource level, and persistence.
Identify social engineering attack types and the controls that defend against them.
Classify malware types by behavior, propagation method, and detection challenge.
Explain application and network attack techniques using the Cyber Kill Chain.
Apply CVE/CVSS for vulnerability prioritization and MITRE ATT&CK for TTP mapping.

Key terms

APT: Advanced Persistent Threat — long-term, stealthy access maintained by a well-resourced threat actor, typically nation-state.
threat actor: Any individual or group that poses a threat to cybersecurity — categorized by motivation, sophistication, and resources.
social engineering: Manipulating people rather than systems to gain unauthorized access to information or facilities.
spear phishing: Targeted phishing attack crafted for a specific individual using personal details to appear credible.
IoC: Indicator of Compromise — artifact or behavior pattern indicating a system has been or is being attacked.
ransomware: Malware that encrypts victim data and demands payment for the decryption key.
rootkit: Malware that modifies the OS or kernel to hide itself — extremely difficult to detect without out-of-band tools.
fileless malware: Malware that executes entirely in memory or via legitimate system tools — no files written to disk.
CVE: Common Vulnerabilities and Exposures — publicly catalogued vulnerability with a unique ID and CVSS score.
CVSS: Common Vulnerability Scoring System — 0–10 severity scale; 9.0+ = Critical.
zero-day: A vulnerability exploited before the vendor has released a patch — no standard defense currently exists.
MITRE ATT&CK: Knowledge base documenting adversary Tactics, Techniques, and Procedures observed in real attacks.
TAXII: Trusted Automated eXchange of Intelligence Information — transport protocol for delivering STIX threat intelligence.
penetration testing: Actively exploiting confirmed vulnerabilities to demonstrate real-world risk — goes beyond passive scanning.

The concept

THREAT ACTORS AND MOTIVATIONS

Not all attackers are the same — their resources, motivations, and persistence vary widely. Nation-state actors are government-funded and represent the highest level of sophistication. They conduct long-term campaigns (APTs) focused on espionage, infrastructure sabotage, or geopolitical disruption. Organized crime groups are financially motivated — they operate ransomware-as-a-service platforms, harvest payment card data, and conduct business email compromise fraud. Hacktivists are ideologically driven, targeting organizations whose activities they oppose. Script kiddies use pre-built tools without deep understanding; they are opportunistic and unsophisticated but can still cause damage at scale. Insider threats are particularly dangerous because they already have trusted access — malicious insiders abuse privileges, while negligent ones create vulnerabilities unintentionally.

SOCIAL ENGINEERING ATTACKS

Social engineering exploits human psychology rather than technical vulnerabilities. Phishing (email) is the most common vector — bulk messages attempt to trick recipients into clicking malicious links or revealing credentials. Spear phishing is targeted, using personal details (job title, recent projects, colleague names) to appear credible. Whaling targets senior executives whose credentials and authorization levels are most valuable. Vishing uses voice calls; smishing uses SMS. Pretexting builds a fabricated scenario over time to establish trust before the attack. Tailgating exploits social norms at physical access points. The defense against social engineering is awareness training, email filtering, MFA, and a security culture where employees challenge unexpected requests regardless of authority.

MALWARE CLASSIFICATION

Malware is categorized by behavior and propagation method. Viruses attach to host files and spread when those files are shared. Worms self-propagate across networks without user action. Ransomware encrypts files and demands payment — recovery requires a clean offline backup, not payment. Rootkits modify the OS to hide themselves and other malware, making detection extremely difficult. Fileless malware runs entirely in memory or via legitimate tools (PowerShell, WMI) — traditional antivirus misses it because there are no files to scan. Keyloggers silently record keystrokes, capturing passwords and credit card numbers. Understanding what each malware type does tells you what detection tool and response approach to use.

APPLICATION ATTACKS AND THE KILL CHAIN

Application attacks target web and software vulnerabilities. SQL injection passes malicious SQL through web forms to manipulate databases. XSS injects client-side JavaScript into pages viewed by other users. Buffer overflows overwrite adjacent memory to redirect program execution. CSRF forces authenticated users to make unauthorized requests via their active session. The Lockheed Martin Cyber Kill Chain models attack progression: Reconnaissance → Weaponization → Delivery → Exploitation → Installation → Command and Control → Actions on Objectives. Defenders can disrupt an attack at any stage — early disruption is always cheaper.

VULNERABILITY MANAGEMENT

CVE IDs standardize vulnerability naming across vendors. CVSS scores (0–10) prioritize severity: Critical (9.0+) demands immediate action. A zero-day has no patch — defenders rely on compensating controls (network segmentation, behavioral monitoring). Vulnerability scanning identifies weaknesses without exploiting them; penetration testing goes further, proving exploitability. MITRE ATT&CK maps observed adversary behavior to specific techniques, helping teams identify detection gaps. STIX/TAXII enables organizations to share threat intelligence in a structured, machine-readable format.

Standards alignment: CompTIA Security+ SY0-701 Domain 1.1 (Threats, Attacks, Vulnerabilities); Maryland Blueprint College and Career Readiness — Technology and Engineering.

Worked examples

Example 1: A financial analyst receives an email that appears to be from her CFO, referencing a real ongoing acquisition and asking her to wire $240,000 to a new vendor account. The email domain is cfo@company-finance.com rather than cfo@company.com — a subtle difference. This is whaling (targeting a senior-adjacent employee) combined with pretexting (fabricated acquisition context). Defense: the analyst calls the CFO directly using a known number (not one in the email) to verify the request. The wire is a BEC (Business Email Compromise) attack — all wire transfers above a threshold should require a second-factor verbal verification.

Example 2: A security analyst reviewing SIEM alerts sees an unusual pattern: a workstation that normally generates 2 MB of outbound traffic per day has generated 800 MB in the past 4 hours, all to an IP address that resolves to a known bulletproof hosting provider. She checks MITRE ATT&CK and identifies the behavior as consistent with T1048 (Exfiltration Over Alternative Protocol). She contains the workstation immediately, preserves the RAM image for forensic analysis, and blocks the destination IP at the perimeter firewall. The CVSS score for the root vulnerability (an unpatched browser exploit, CVE-2026-XXXX, score 8.8) is high — patching is added to the remediation ticket.

Common mistakes

Confusing vishing (voice calls) with pretexting — pretexting is the fabricated scenario used in any channel; vishing is the delivery mechanism (voice).
Assuming fileless malware requires physical access to install — it typically arrives via phishing or a browser exploit and runs entirely in memory.
Treating all CVEs with equal urgency based on CVSS score alone — a CVSS 9.0 with no public exploit may be lower priority than a CVSS 7.0 being actively exploited in the wild.
Confusing bluejacking (sending unsolicited BT messages — nuisance only) with bluesnarfing (unauthorized data access — a real breach).
Assuming replay attacks require decrypting captured traffic — they retransmit valid captured tokens without decryption; timestamps and nonces in protocols prevent this.

Self-check

Try each question before reading the answer. Answers at the bottom of this page.

1. Which threat actor type is primarily motivated by financial gain?

Nation-state actor
Hacktivist
Cybercriminal (organized crime)
Insider threat

2. What distinguishes spear phishing from general phishing?

Spear phishing uses SMS
Spear phishing targets a specific individual with personalized details
Spear phishing only targets executives
Spear phishing requires physical access

3. A rootkit is especially dangerous because:

It self-replicates across the network
It encrypts files for ransom
It modifies the OS to hide itself — defeating normal detection
It captures network traffic

4. A CVSS score of 9.5 is classified as:

High
Critical
Medium
Low

5. MITRE ATT&CK documents:

Known CVEs and patch information
Firewall rule recommendations
Adversary Tactics, Techniques, and Procedures from real attacks
Encryption algorithm strengths

Self-check answers

1. C — Organized criminal groups operate cybercrime enterprises for profit — ransomware-as-a-service, BEC, and payment card theft are common tactics.
2. B — Spear phishing is targeted — the attacker researches the victim and uses personal details (name, role, recent events) to appear credible.
3. C — A rootkit modifies the OS kernel or drivers to conceal itself — traditional AV tools cannot see it. Detection requires booting from trusted external media.
4. B — CVSS 9.0–10.0 is Critical. A score of 9.5 falls in this band and demands immediate prioritization.
5. C — MITRE ATT&CK is a knowledge base built from real attack observations — security teams use it to map detection coverage and identify gaps.

Canvas is the official record. This companion enhances the PGCC curriculum; it does not replace it. Last name and class year only. Students with a 504 plan or IEP: your accommodations apply.

↑ Back to top